Both Sides of the Table — The Ransomware Negotiator Works for the Crew — severe-but-plausible scenario — ITOL

Vector: Insider Threat · Severity: severe

A ransomware crew encrypts about 900 servers in the bank's corporate estate on a Saturday, run from the virtualization layer with stolen hypervisor credentials: the commercial lending platform, the lockbox imaging system, which scans the checks the bank collects for its clients, and the wealth clients' document store. The core, the payment platforms and the digital channels sit in their own segments and run on. The insurer's hotline confirms the bank's own counsel and forensics firm by 06:00 and adds the one seat the bank has never met: a ransomware negotiation firm from its panel, the responders it pre-approves and pays for. On the 09:00 kickoff call the bank says what its policy covers, what it would rather do, and how it will restore. The firm's lead negotiator is on that call. He is selling all of it to the crew.